n
RETAIL POLITICS
Congress is back at work trying to pass
a nationwide law requiring businesses
to notify consumers when credit card
numbers or other sensitive data are
breached - and NRF is working to be
sure banks and the card industry aren't
exempted from requirements that would
be placed on retailers.
The last time lawmakers voted on data
breach legislation was 2015, when the
House Financial Services Committee
approved a measure that would have
made notification mandatory for retailers
but voluntary for financial institutions.
NRF was able to keep the bank-backed
bill from moving further, arguing that
any new data breach law should cover all
businesses that handle consumer data.
The committee hopes to approve
another bill this year, and NRF wants to
make sure lawmakers are not pressured
by banks into passing a repeat of the
2015 measure. NRF supports a uniform,
nationwide data breach notification
law because the separate and oftenconflicting data breach laws currently on
ANTB/SHUTTERSTOCK.COM
Congress Returns to Data Breach Debate
the books in 48 states and the District of
Columbia are confusing for consumers
and create compliance challenges for
multi-state retailers. But NRF told the
committee that legislation must "leave
no holes in our system that would enable
some industries to keep the fact of their
breaches secret."
NRF is also working with the House
Energy and Commerce Committee,
which is developing a bill of its own
and held a "listening session" where
NRF voiced its concerns. A bill approved
by that committee in 2015 would have
applied to retailers while leaving out
telecommunications companies along
with banks.
Breaches at retail companies grab
headlines because the companies involved
are familiar household names. But the
financial services industry suffers five
times as many breaches as retailers each
year, and incidents such as last year's
massive breach of 143 million consumers'
data at the Equifax credit reporting
agency could have been kept secret if the
2015 bills had become law.
NRF wants any new data breach
law to cover all business that possess
sensitive consumer data, preempt existing
state and local laws, set "reasonable"
standards that recognize that most
businesses don't hold the same level
of consumer financial information that
banks hold, and place enforcement under
the Federal Trade Commission.
Retailers and other businesses sued for
violations of the Americans with Disabilities
Act would be given a chance to correct
the alleged problems under legislation
approved by the House.
"An increasing number of attorneys are
undermining the ADA by filing drive-by
lawsuits with unfounded inaccessibility
claims to extort settlements," NRF Senior
Vice President for Government Relations
David French said. "This [legislation] will
allow businesses to dedicate resources to
accommodating their customers rather than
diverting them to specious allegations."
Unlike other laws that restrict enforcement
action to official government agencies,
the ADA allows disabled individuals to file
a lawsuit and collect damages when they
find a violation of the law's thousands of
8
STORES April 2018
TAEWAFEEL/SHUTTERSTOCK.COM
Bill Would Let Businesses Fix ADA Violations
Before Facing Lawsuits
requirements for issues such as the height
of mirrors, steepness of wheelchair ramps or
placement of light switches. The provision
has resulted in a proliferation of suits in
recent years, costing business owners
millions of dollars even if they agree to bring
their buildings into compliance.
Under the ADA Education and Reform
Act, businesses that are sued would be
given 60 days to provide a written response
and 120 days to make changes to correct
the violation. Lawsuits could only move
forward if the business failed to make the
response and corrections.
The bill passed the House in February but
still needs approval by the Senate before it
can go to President Trump for his signature.
While the House legislation would
deal with stores and other buildings,
NRF is also working with Congress and
in the courts on additional reform that
would address lawsuits filed by blind and
visually impaired consumers over the
accessibility of retailers' websites. NRF
has argued that those suits should be
blocked because there are no clear legal
requirements for website accessibility
under current federal law.
STORES.ORG